CVE-2022-49152

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> XArray: Fix xas_create_range() when multi-order entry present<br /> <br /> If there is already an entry present that is of order &gt;= XA_CHUNK_SHIFT<br /> when we call xas_create_range(), xas_create_range() will misinterpret<br /> that entry as a node and dereference xa_node-&gt;parent, generally leading<br /> to a crash that looks something like this:<br /> <br /> general protection fault, probably for non-canonical address 0xdffffc0000000001:<br /> 0000 [#1] PREEMPT SMP KASAN<br /> KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]<br /> CPU: 0 PID: 32 Comm: khugepaged Not tainted 5.17.0-rc8-syzkaller-00003-g56e337f2cf13 #0<br /> RIP: 0010:xa_parent_locked include/linux/xarray.h:1207 [inline]<br /> RIP: 0010:xas_create_range+0x2d9/0x6e0 lib/xarray.c:725<br /> <br /> It&amp;#39;s deterministically reproducable once you know what the problem is,<br /> but producing it in a live kernel requires khugepaged to hit a race.<br /> While the problem has been present since xas_create_range() was<br /> introduced, I&amp;#39;m not aware of a way to hit it before the page cache was<br /> converted to use multi-index entries.